Privacy Policy

1. Controller and Contact Information

This privacy policy applies to data processing by:

2. Data Processing on Our Website

2.1. Hosting, Access Data, and Security

Our website is hosted on servers provided by Scaleway S.A.S., 8 rue de la Ville l'Évêque, 75008 Paris, France, with hosting region set to Paris (EU). Website traffic is routed globally through the bunny.net network for DNS resolution, caching, DDoS protection, and firewall services.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure and efficient service delivery)

Data transfer: Scaleway processes data exclusively in the EU (Paris region). bunny.net routes DNS requests globally but delivers website content regionally. Personal data (e.g., from forms) is sent only to Scaleway (Paris).

Retention period: bunny.net stores access and security logs for a limited period, typically up to 7 days, unless longer retention is needed for abuse detection or diagnostics.

Encryption: All traffic to and from our website is encrypted using TLS/SSL.

2.2. Contact Form

You can contact us via a form on our website. We collect:

• Name
• Email address
• Organization
• Message
• Optional: consent to receive our newsletter

Form data is submitted to Scaleway (Paris) and sent via Resend, an email infrastructure provider based in the USA, with delivery from EU (Ireland).

Data transfer to third countries: While emails are sent from within the EU, metadata may be processed by Resend in the USA. Resend states GDPR compliance.
Privacy policy: https://resend.com/legal/privacy-policy

Retention: Contact form data is retained for up to 24 months to facilitate follow-up and future communication.

2.3. Newsletter Subscription

When you subscribe to our newsletter, we collect:

We use EmailOctopus, operated by Three Hearts Digital Ltd (UK). Data is stored in the EU (AWS infrastructure).

Legal basis: Article 6(1)(a) GDPR (your consent)

Data transfer: There is no transfer to countries outside the EU/EEA. EmailOctopus confirms full GDPR compliance.
Further info: https://emailoctopus.com/legal/gdpr

Retention and deletion: Newsletter subscription data is stored for the duration of the subscription. After unsubscribing, data will remain stored in our email system (EmailOctopus) with unsubscribed status unless manually deleted. You may request full deletion at any time.
We regularly review and delete inactive unsubscribed contacts after a defined retention period (e.g., 12 months), unless further retention is required to comply with legal obligations or to document prior consent.

Withdrawal of consent: You can unsubscribe at any time via the link in each newsletter or by contacting us directly.

2.4. Embedded LinkedIn Content

We offer the option to view content from our LinkedIn company page directly on our website via embedded iframes.

Data transfer only occurs if you give consent via our cookie banner or by manually clicking the placeholder to load LinkedIn content. Before that, no connection to LinkedIn's servers is established and no personal data is transmitted.

When consent is given, LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA may process the following data:

• IP address
• Browser and device information
• Referrer URL
• Interaction with embedded content
• Cookies or similar technologies

The embedded content also loads bot-detection scripts from HUMAN Security, Inc. (domain protechts.net), a service provider of LinkedIn, which set their own cookies (see section 5).

Purpose: Displaying professional updates and strengthening our external communications.

Legal basis: Article 6(1)(a) GDPR (your explicit consent)

Data transfer: LinkedIn processes data in the USA. Data transfers are governed by Standard Contractual Clauses (SCCs).

Withdrawal of consent: You can revoke your consent at any time using the cookie settings on our site.

2.5. Cloudflare Turnstile Spam Protection

All forms on our website are protected against automated submissions by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (EU contact: Cloudflare Germany GmbH, Rosenheimer Straße 143C, 81671 Munich). The check runs in the background when a form is displayed.

Cloudflare Turnstile may process the following data:

• IP address
• Browser and device signals (e.g., user agent, TLS fingerprint)
• Our site key and the page the form is on
• The verification token that is sent along with your submission

Purpose: Distinguishing human visitors from bots and preventing spam and abuse of our forms. Cloudflare Turnstile does not set cookies on our website.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure operation of our forms and prevention of abuse)

Data transfer: Cloudflare may process data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR). Cloudflare acts as our processor for the bot check itself.

Further information: Cloudflare Turnstile Privacy Addendum

3. Data Retention Summary

4. Your Rights under the GDPR

You have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Request erasure of your data (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))

To exercise your rights, please contact us at:
privacy25 (at) paxup (dot) com

You also have the right to lodge a complaint with your supervisory authority. For PaxUp, the competent authority is:

5. Cookies

We use a consent-based cookie banner. No non-essential cookies are set and no LinkedIn content is loaded unless you explicitly agree. The Cloudflare Turnstile bot check on our forms (section 2.5) runs without cookies.

The following cookie is set without consent because it is strictly necessary to remember your choice (Section 25(2) No. 2 TDDDG):

If you accept analytics cookies, the embedded LinkedIn content sets cookies from LinkedIn (JSESSIONID, lang, bcookie, bscookie, li_gc, lidc, __cf_bm, li_alerts) and from the bot-detection provider HUMAN Security used by LinkedIn (_pxvid, _px3, pxcts). Their lifetimes range from the browser session to one year. The full list with descriptions is available in the cookie settings on our website.

You can modify or withdraw your consent anytime via the cookie settings on our website.

6. Updates to This Policy

We may update this policy to reflect legal, technical or operational changes. The most recent version is always available at https://paxup.com/privacy.